CVE-2025-3928: Commvault Web Server Unspecified Vulnerability
Commvault Web Server contains an unspecified vulnerability that allows a remote, authenticated attacker to create and execute webshells.
Other sources
Commvault Web Server has an unspecified vulnerability that can be exploited by a remote, authenticated attacker. According to the Commvault advisory: "Webservers can be compromised through bad actors creating and executing webshells." Fixed in version 11.36.46, 11.32.89, 11.28.141, and 11.20.217 for Windows and Linux platforms. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) Catalog on 2025-04-28.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Commvault Web Serverto a version that resolves this vulnerability.Fixed in 11.36.46 - Upgrade
Upgrade
Commvault Web Serverto a version that resolves this vulnerability.Fixed in 11.32.89 - Upgrade
Upgrade
Commvault Web Serverto a version that resolves this vulnerability.Fixed in 11.28.141 - Upgrade
Upgrade
Commvault Web Serverto a version that resolves this vulnerability.Fixed in 11.20.217 - Compensating control
Follow applicable BOD 22-01 guidance for cloud services and implement vendor-provided mitigations to prevent remote, authenticated attackers from creating and executing webshells. If mitigations are unavailable, discontinue use of the product.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3928?
CVE-2025-3928 is a critical vulnerability that can be exploited by remote authenticated attackers to compromise the Commvault Web Server.
How do I fix CVE-2025-3928?
To fix CVE-2025-3928, upgrade your Commvault Web Server to versions 11.36.46, 11.32.89, or 11.28.141.
What are the potential impacts of CVE-2025-3928?
The potential impact of CVE-2025-3928 includes unauthorized access to the webserver and the ability for attackers to execute malicious webshells.
Who is affected by CVE-2025-3928?
Organizations using Commvault Web Server versions prior to 11.36.46, 11.32.89, 11.28.141, or 11.20.217 are affected by CVE-2025-3928.
What is the exploit mechanism for CVE-2025-3928?
CVE-2025-3928 can be exploited through the execution of webshells by remote authenticated attackers.